meta-issue: triage for Singapore IETF meeting

[kwantam]

The next IETF meeting in Singapore happens soon. The cutoff for submitting a new I-D is November 4th at 23:59 UTC. This issue is to help with triage.

High priority

• Z selection (Z selection pseudocode #159, require Z != -1 for s-swu #171, update Z selection, add pseudocode, promote SvdW map #172) --- PR is merged (update Z selection, add pseudocode, promote SvdW map #172)

• SvdW update (cover S--vdW at least for j=0 and j=1728 cases #155, define sign of sqrt in constants for S-vdW and others #157, update Z selection, add pseudocode, promote SvdW map #172) --- PR is merged (update Z selection, add pseudocode, promote SvdW map #172)

• Ciphersuite updates (consider using WB19 approach for secp256k1 (and others?) #158) --- PR is merged (update Z selection, add pseudocode, promote SvdW map #172)

• sgn0 / sqrt definitions (possible enhancement: simplify sgn0 #144) --- I've got a PR in the wings for this. I'll push it to completion and submit it in the next couple days. PIR is merged (make sgn0 definition per-suite ; improve descriptions of sgn0 and sqrt functions #176)

• Coordinate with Ristretto --- can happen before or after. Main goal is to figure out what the right API is, both for Ristretto and for whichever pieces of h2c the Ristretto draft uses.

• Coordinate with VRF --- I've opened a pull request (Incorporate hash-to-curve by reference fcelda/nsec5-draft#35) against VRF for this. Probably safe to assume we'll coordinate there for this.

Nice to have

• Handle some out-of-band comments from emails (some of these haven't been translated to issues)

• Discussion of alternative hash_to_base algorithms (Support for SHA-3 and SHAKE / cSHAKE #165) --- probably just want a paragraph in Suites talking about how to indicate that a suite uses an alternative hash_to_base (e.g., SHAKE). PR is merged (requirements and guidelines for alternative hash_to_base functions #175)

• Style nits (style nits: spacing around math operators #105) --- might be nice to do a sweep for these, if there's time.

• Variable naming nits (style nits: variable naming #110) --- same as above.

Not now

• cofactor clearing pseudocode (cofactor clearing pseudocode #166) --- I think this probably goes in the pairings draft, not ours, right?

• 404 link in readme #164 --- only pertains to the repo, not the draft

• Decide on removing supersingular maps (proposal: remove the maps to supersingular curves #173) - I'd like to talk to some more folks before we make a decision on this. I'm going to be at the ECC Workshop in December---maybe some people there have an opinion.

• Flow-chart (Add flow-chart to determine algorithm for an arbitrary curve #63, Including one diagram #118) - nice to have, but probably doesn't go inside the draft, so we can push this to later.

• Code clean-up (Update reference code quality #98, meta-issue: implementation cleanup #112, add README in poc that gives correspondence between code and sections of the document #151) --- hate to keep kicking this can down the road, but we've got enough on our plates and I doubt there's time. (This also includes test vectors...)

Issues that can be closed right now

I think all of the following can be closed without further action. Please reply if you disagree.

• Composition of encoding + Ristretto/Decaf #43 - Ristretto will handle this
• encoding for pairings G1 and G2 #95 - Suites now handle this
• BLS integration considerations #96 - BLS sigs draft now handles this
• discuss point conversions (perhaps in appendix) #107 - we now discuss the relevant conversions
• possible enhancement: mapping to projective coordinates everywhere #109 - we decided to do projective in the appendices and affine in the body
• optimized straight-line implementations: generic or specific? #111 - we decided to do generic straight-line in body text, specific appendix
• ciphersuites and domain separation #124 - we've decided on a plan here, and it's in the text
• Scoping the definition of suites #126 - I think we've got a plan here, too

[kwantam]

CC @chris-wood @armfazh please let me know whether you think any of the "issues that can be closed" above should stay open.

I'm going to have new PRs to handle most of the "high priority" issues in the next few days. My plan was mostly to rely on y'all for reviewing, if that's OK.

[chris-wood]

@kwantam I'm fine with closing those ones, and I'm happy to review the high priority issues as they come in. I'll fix #164 and work on code quality and test vectors from our Sage implementations. I'll also claim #105 and #110.

[kwantam]

I spoke with @reyzin about incorporating hash-to-curve by reference in the next version of the VRF document. The plan is to push ahead with edits to VRF after we've pushed draft-05. I'll plan to put together a PR against VRF at that time.

[kwantam]

We've pushed -05, so this issue is done. We'll bring remaining issues forward on the next push.